CVE-2018-1000632

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-08-20 · updated 2026-06-17
Weakness: CWE-91

Description

dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.

Affected products

Debian Linux: 8.0
Dom4J Project Dom4J: from 2.0.0 before 2.0.3; from 2.1.0 before 2.1.1 — fixed in 2.0.3, 2.1.1
NetApp OnCommand Workflow Automation: all versions
NetApp Snap Creator Framework: all versions
NetApp SnapCenter: all versions
SnapManager for Oracle: all versions
Oracle Corporation FLEXCUBE Investor Servicing: 12.0.4, 12.1.0, 12.3.0, 12.4.0, 14.0.0
Oracle Corporation Primavera P6 Enterprise Project Portfolio Management: from 16.1.0.0 through 16.2.20.1; from 17.1.0.0 through 17.12.17.1; from 18.1.0.0 through 18.8.19.0; from 19.12.0.0 through 19.12.6.0
Oracle Corporation Rapid Planning: 12.1, 12.2
Oracle Corporation Oracle Retail Integration Bus: 15.0, 16.0
Oracle Corporation Utilities Framework: from 4.3.0.2.0 through 4.3.0.6.0; 2.2.0, 4.2.0.2.0, 4.2.0.3.0, 4.4.0.0.0, 4.4.0.2
Red Hat JBoss EAP: 6.0.0, 6.4.0, 7.1.0
Red Hat Satellite 6: 6.6
RedHat Satellite Capsule: 6.6

How to fix

Upgrade to a fixed version: Dom4J Project Dom4J 2.0.3, 2.1.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-1000632 or the next vulnerability affects your stack